I wanted to add a very clear answer here so that it was obvious to everyone who wanders past here. It’s been said several times in other answers, but here it is, as clear as I can make it:

dragover DOES NOT HAVE THE RIGHTS to see the data in the drag event.

This information is only available during the DRAG_START and DRAG_END (drop).

The issue is it’s not obvious at all and maddening until you happen to read deeply enough on the spec or places like here.

WORK-AROUND:

As a possible work-around I have added special keys to the DataTransfer object and tested those. For example, to improve efficiency I wanted to look up some “drop target” rules when my drag started instead of every time a “drag over” occurred. To do this I added keys identifying each rule onto the dataTransfer object and tested those with “contains”.

ev.originalEvent.dataTransfer.types.includes("allow_drop_in_non_folders")

And things like that. To be clear, that “includes” is not a magic bullet and can become a performance concern itself. Take care to understand your usage and scenarios.